Illegal Crypto Mining & The Grid
When we think about someone who stops crime, often police, or some similar federal agency tends to come to mind … rarely is it the local tax officer that we think about disrupting corruption and illegal activities.
However, in a case out of Romania, their tax inspectors uncovered a cryptocurrency mining operation running hundreds of machines inside a building officially associated with no declared economic activity.
This article isn’t about crypto mining itself per say, its about how a legal business model is very often utilized in an illegal way and can put considerable strain on the grid and locals.
The Case
Romania’s antifraud tax directorate discovered the mining farm during a risk analysis and subsequent operational checks.
According to ANAF, inspectors found major differences between the activity taking place at the location and the information declared to tax authorities. The agency described the property as a decommissioned building and said the cryptocurrency operation was running outside the country’s fiscal and accounting system.
Inspectors seized the entire mining infrastructure, including 407 specialised machines valued at more than 2 million RON.
ANAF has not disclosed what cryptocurrencies were being mined, how much the operation produced, where the resulting assets were stored, or how long the equipment had been present.
No arrests have been announced. The agency said it may refer the matter to criminal investigators if the continuing examination identifies evidence of a crime.
Crypto mining itself is not illegal in Romania. The problem was that this operation allegedly existed outside the country’s normal business, accounting, and tax systems. ANAF said the people running the farm were not legally organised to conduct the activity, reported no economic activity at the site, and declared none of the income generated there.
That stood in sharp contrast to a facility operating 407 machines continuously and consuming an estimated 7 million RON in electricity over nine months.
The tax office said its inspection began after risk analysis exposed major discrepancies between the activity taking place inside the building and the information submitted to authorities.
Investigators are now calculating the undeclared revenue and unpaid tax; any criminal referral will depend on what that examination finds.
The Actors
The people behind the operation have not been publicly identified.
ANAF said the activity was conducted by people who were not organised in accordance with Romanian law, but it did not name an individual, company, tenant, owner, or criminal group. It also did not explain who controlled the building or held the electricity account.
The operators may have occupied the property with permission, leased part of it through an undisclosed arrangement, or used it without the owner’s knowledge.
Global Mining Economics
Cryptocurrency mining is a global industrial business, revenue depends on the coin being mined, the number and efficiency of the machines, network difficulty, electricity prices, equipment downtime, and the market value of the resulting cryptocurrency.
Bitcoin miners are paid through newly issued coins and transaction fees. In late 2024, the network was generating roughly $40 million in gross mining revenue per day, although that figure moves sharply with Bitcoin’s price and network conditions.
Cambridge researchers found that electricity alone accounts for more than 80 percent of miners’ cash operating expenses, with hardware, cooling, staffing, rent, financing, and maintenance taking further cuts. A farm can generate substantial cryptocurrency and still lose money if its power is expensive or its machines are outdated.
There is no credible global figure dividing legal mining from illegal mining. Hidden farms do not report their output, and blockchain data generally cannot show whether the electricity behind a mined coin was purchased legally.
Malaysia identified 13,827 premises linked to unauthorised mining power use between 2020 and August 2025, with estimated utility losses of $1.11 billion. That is evidence of a serious criminal market, but it cannot be converted into a reliable worldwide percentage.
Illegal Mining
The two big factors as far as cost are concerned when it comes to crypto mining are going to be the hardware that you need.
The more hardware you have, the faster and more efficiently you can mine Bitcoins or crypto money. The second is going to be electricity. And while you can't really skirt the first, you can definitely skirt the second. And there's a lot of illegal ways of doing this that people take advantage of all the time.
According to Ofgem (UK energy regulator),
In countries where cryptocurrency mining is legal, the criminal conduct often begins at the electrical connection rather than at the mining machines. The most common pattern reported by utilities is meter tampering or an illegal bypass that allows power to reach the equipment without being fully recorded.
For example, Ofgem currently estimates that energy theft and meter tampering cost consumers in Great Britain more than £1.4 billion a year. That figure covers gas and electricity rather than electricity alone, but it gives a useful sense of scale.
In countries where monthly meter prices are estimated based upon previous years, tenants using false identities can rent an apartment or building, utilize significantly more energy than normal via mining and leave before the annual meter check, having effectively stolen a years worth of electricity.
Strain on the Local Power Network
The British electricity grid once had to plan around television schedules. During major programs and sporting events, operators anticipated sudden demand spikes when millions of viewers used commercial breaks or half-time to switch on their kettles. The phenomenon became known as TV pickup, and a typical surge could add hundreds of megawatts to national demand within minutes.
An illegal mining farm creates a different kind of problem. Instead of a brief, predictable spike, hundreds of machines can draw heavy power continuously, day and night. A house may suddenly be carrying an industrial load through wiring, switchgear, and local transformers that were never expected to support it.
Meter tampering makes the demand harder to see through normal account data. The altered meter may report little or no increase, but the cables and local distribution network still carry the full current. The result can be overheated wiring, damaged transformers, voltage problems, repeated outages, and fire risk inside the property.
Conclusion
Most countries allow crypt mining, but given one of the biggest costs of the industry being electricity, it is obvious that criminals would try to limit or even eliminate this expense all together.
But now you have criminals attempting to “adjust” the cabling and power lines to their benefit, which can obviously have issues that go beyond tax avoidance.
I wanted to highlight this story because I think there was a deeper security issue that may have gone unnoticed, but I am curious about what your thoughts on this are.
Training Resources:
For individuals looking for a hands on training that includes all of the above topics, Covert Access Team (covertaccessteam.com) provides training courses focused on physical penetration testing, lockpicking, bypassing techniques, social engineering and other essential skills.
Covert Access Training - 5 day hands on course designed to train individuals and groups to become Covert Entry Specialists
Physical Audit Training - 2 day course on how to setup and run a physical security audit
Elicitation Toolbox Course - 2 day course of that primarily focuses on elicitation and social engineering as critical aspects of Black Teaming
Strategic Operations for Lone Operators - Advanced course for those who are interested in learning how to become a one man infiltration team.
Counter Elicitation - 2 day course on how to recognize and prevent elicitation attempts, and safegaurd your secrets.
Cyber Bootcamp for Black Teams - 2 day course designed explicitly for physical penetration testers who need vital cyber skills to add to their toolbox.
Private Instruction - Focused learning & training based on your needs .